CVE assignment notification -- CVE-2010-0427 -- sudo fails to reset group permissions if runas_default set

[Jan Lieskovsky <jlieskov () redhat com>]

Hi vendors,

  1, apologize for separate post (needed to investigate the
     issue first).

  2, more about sudo "fails to reset group permissions
     if runas_default set" issue:

     Sudo failed to properly reset group permissions, when
     'runas_default' option was used. If a local, unprivileged
     user was authorized by sudoers file to perform their
     sudo commands under default user account, it could lead
     to privilege escalation.

Upstream bug report:
  [1] http://www.gratisoft.us/bugzilla/show_bug.cgi?id=349

Upstream patch:
  [2] http://sudo.ws/repos/sudo/rev/aa0b6c01c462 (against v1.6 branch)
  [3] http://www.sudo.ws/cgi-bin/cvsweb/sudo/set_perms.c.diff?r1=1.30.2.7&;> r2=1.30.2.8

Other references:
  [4] https://bugzilla.redhat.com/show_bug.cgi?id=567622

Affected versions:
  a, issue tested and confirmed in sudo-1.6.9p17 version, prior v1.6.x
     based versions might be also affected. Issue fixed
     in upstream 1.6.9p21 version.
  b, v1.7.x based versions of sudo are not affected by this
     flaw due the differences in the way sudoers file is parsed.

CVE: CVE identifier of CVE-2010-0427 has been already assigned to this issue.

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Thanks to Todd C. Miller for pointing me to [2] and sudo
      v1.7.x situation clarification.